Add inactive duty-separation evaluator

[yihanzhu]

Summary

• Add the inactive duty-separation policy, canonical decision, and pure observation evaluator.
• Bind the exact policy set, its validator driver/program, selected public-core package closure, evaluator driver/program, and stage tuple identities.
• Enforce five-role ceilings, three identity dimensions, dormant publisher state, and deterministic fail-closed results.

Boundary

This unit evaluates declared core contracts only. It grants no authority, activates nothing, reads no credential, runs no candidate, and performs no network, publish, merge, or external write. Effective sandbox, credential, risk, kill-switch, evidence, and publisher enforcement remain separate Roadmap item 2 units.

Targeted proof

Exact head/base: e69a537 / 1fc6142.

• official jq 1.6 under an outer 240-second hard timeout: 56 focused checks
• every race marker and completion wait has a fixed iteration deadline and detects evaluator exit
• FIFO-gated supervisors establish and validate an owned process group before evaluator or nested fixture execution
• timeout/EXIT cleanup signals the full owned group, uses bounded TERM/KILL polls, reaps the leader, preserves ownership/scratch on failure, and forces a nonzero final status
• nested-child, setup-failure, marker-timeout, completion, and forced post-KILL-live branches are covered
• canonical decision binds policy, evaluator driver/program, and policy-set validator driver/program before validation
• only independently revalidated private mirrors execute for policy-set and public-core validation
• live/mirror drift returns E_RELATION before policy/core errors; mutation, swap/restore, ancestry symlink, and member-shape cases are closed
• selected generation is derived from the public wrapper and registry; no raw selected generation ID appears in this unit
• canonical core package identity covers wrapper, registry, and all seven selected-generation files in fixed order
• output decision, policy, stage, verdict, and reason identities are independently validated before emission
• portable-core schema proof: 47/47 owned rules, 141/141 direct cases, 39/39 activation guards, zero failures
• ShellCheck 0.11.0, Bash syntax, canonical artifacts, diff, and restore-manifest checks: clean
• full independent read-only pre-audit: no unresolved Important finding
• review size is dominated by private mirrors and adversarial lifecycle/mutation proof; the PR remains one inactive evaluator concern

Roadmap item 2: Control foundation.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	e69a537
Status:	✅  Deploy successful!
Preview URL:	https://72dc8fc6.fabrica-6yx.pages.dev
Branch Preview URL:	https://codex-control-duty-separatio.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 52e3467
Reviewed-base: 1fc6142
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/209-3581/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The evaluator's reported identities do not fully bind either the executable core package or the decision definition. Consequently altered or unrelated decision logic can be presented under trusted-looking immutable references.

Full review comments:

• [P2] Bind the full core package before executing it — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.4xhzVgZb5A/control/v1/evaluate-duty.sh:76-76
  When a selected-generation dependency such as core-ingress.sh, contracts.jq, or a module is modified while the wrapper remains unchanged, this check still passes and the evaluator executes the altered package while reporting the pinned package identity. This is especially significant because the ingress file is sourced shell code. Bind a manifest or digest covering the wrapper and its complete selected-generation closure before validation.

• [P2] Validate the section's decision reference — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.4xhzVgZb5A/control/v1/duty-separation.jq:191-191
  When callers supply two valid policy sets that differ only in the duty-separation decision_ref.sha256, both are accepted and this evaluator echoes each arbitrary reference even though the policy and decision program are unchanged. The result therefore claims an immutable decision identity that is not bound to any shipped decision artifact or evaluator content; verify that reference against a canonical decision definition before returning it.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: f5110e6
Reviewed-base: 1fc6142
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/209-52076/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The evaluator executes validation code that is outside its declared integrity binding. This allows its accepted input contract and executed behavior to drift without invalidating the policy or decision references.

Review comment:

• [P2] Bind the policy-set validator into the evaluator decision — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.11OGiWamOb/control/v1/evaluate-duty.sh:193-195
  When validate.sh or its loaded policy-set.jq is stale or modified, this invokes that unbound code before any integrity check. Neither file is snapshotted, hashed, postflight-checked, nor referenced by the decision, so the decision-bound evaluator can silently change which policy sets it accepts—or execute changed shell/JQ—without changing any bound identity. Include both files in the evaluator's bound closure before executing the validator.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 34022e0
Reviewed-base: 1fc6142
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/209-6709/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The evaluator implementation appears coherent, but the newly added race tests can leave CI stuck indefinitely when an expected marker is not produced. This should be fixed before considering the patch correct.

Review comment:

• [P2] Bound the marker polling loops — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.Ld4ErupPZA/scripts/test/control-duty-separation.test.sh:479-480
  If the evaluator returns before creating core-closure-mirror.json, this background process spins forever and the subsequent wait never completes; the same unbounded pattern is repeated for the validator markers. Any regression in an earlier evaluator step can therefore hang the entire CI job instead of reporting a test failure, so these waits need a timeout and explicit failure path.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: e69a537
Reviewed-base: 1fc6142
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/209-62085/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The duty-separation evaluator consistently validates and binds its policy, decision, validator, core closure, and stage inputs. The added tests cover expected verdicts, malformed inputs, identity violations, stale dependencies, and race-sensitive execution paths.